Skip to content

Instantly share code, notes, and snippets.

@JamesTheAwesomeDude

JamesTheAwesomeDude/restorecon-xtables-lock.service

Last active June 26, 2022 01:43
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save JamesTheAwesomeDude/0a6bf7792908f2f9023d56cdc8799c8f to your computer and use it in GitHub Desktop.
Save JamesTheAwesomeDude/0a6bf7792908f2f9023d56cdc8799c8f to your computer and use it in GitHub Desktop.
Download ZIP
Fix for RHEL Bugs #1436904 #1376343
Raw
restorecon-xtables-lock.service
# /etc/systemd/system/restorecon-xtables-lock.service
# Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1436904#c3
# Author: James Edington <james.edington@uah.edu>
# HOWEVER, IF YOU ARE READING THIS, you probably need to be
# configuring the McAfee Firewall *instead of* interacting with iptables yourself:
# https://docs.mcafee.com/bundle/endpoint-security-10.6.6-firewall-product-guide-linux/page/GUID-481C8EE3-A371-4D86-8BF4-BB5C18B8C7F9.html
# Example:
# /opt/McAfee/ens/fw/bin/mfefwcli --fw-rule-add --name ALLOW_OUTBOUND --action allow --direction out --notes "Allow all outbound connections from ${HOSTNAME-scanner} per requirements for IDS functionality"
[Unit]
Description=Restore SELinux context on xtables.lock
After=mfefwd.service
[Service]
Type=oneshot
RemainAfterExit=false
ExecStart=/usr/sbin/restorecon /var/run/xtables.lock
[Install]
WantedBy=multi-user.target
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment